Logcollector now supports socket connection for log output mirroring. This feature allows to send the same event to the Wazuh manager and to a 3rd party log processor like Fluent Bit. You can find more information here.

The analysis engine includes new options for the plugin decoders to set the input offset with respect to the prematch expression or the parent decoder. See an example about this on this section. In addition, plugin decoders and multi-regex decoders can be used together.

We have also introduced an event formatter in the log collector to build custom events, this allows to add some data into the event.

As of this version, the timestamp of the alerts in JSON format will include milliseconds.

The implementation of the Agentless daemon has been improved for enhanced security.

Some other fixes and improvements have been introduced in the Framework and the Cluster.